build.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31

Parameters:
  OrganizationsVendingMachineEndpoint:
    Type: String
  RootMailDomain:
    Type: String
  DeploymentBucket:
    Type: String
    Default: superwerker-deployment
  AllowedGitHubAccountIDs:
    Type: CommaDelimitedList
  SkipBuildCommitMessageRegExp:
    Type: String
    Default: \[skip ci\]

Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: codebuild/pr-builds/superwerker
      RetentionInDays: 30

  PublicReadRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Description: A role required for CodeBuild to access CloudWatch Logs for public visibility
      Policies:
        - PolicyName: S3CloudWatchLogs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - logs:GetLogEvents
                Resource: !GetAtt LogGroup.Arn
                Effect: Allow

  BuildAndTestProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: build-pull-request
      TimeoutInMinutes: 180
      BuildBatchConfig:
        ServiceRole: !GetAtt BuildAndTestProjectRole.Arn
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:4.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: ROOT_MAIL_DOMAIN
            Value: !Ref RootMailDomain
          - Name: ORGANIZATIONS_VENDING_MACHINE_ENDPOINT
            Value: !Ref OrganizationsVendingMachineEndpoint
          - Name: TEMPLATE_BUCKET_NAME
            Value: !Ref DeploymentBucket
          - Name: TEMPLATE_REGION
            Value: !Ref AWS::Region
          - Name: SUPERWERKER_CLEANUP_STATE_MACHINE
            Value: !ImportValue superwerker-tests-CleanupStateMachine
      ServiceRole: !GetAtt BuildAndTestProjectRole.Arn
      Artifacts:
        Type: NO_ARTIFACTS
      Source:
        Type: GITHUB
        Location: https://github.com/superwerker/superwerker.git
        BuildSpec: tests/buildspec.yaml
      Visibility: PUBLIC_READ
      ResourceAccessRole: !GetAtt PublicReadRole.Arn
      LogsConfig:
        CloudWatchLogs:
          GroupName: !Ref LogGroup
          Status: ENABLED

  CleanupProjectForStepFunction:
    Type: AWS::CodeBuild::Project
    Properties:
      TimeoutInMinutes: 20
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:4.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: CAPTCHA_API_KEY
            Value: /superwerker/tests/2captcha_api_key
            Type: SECRETS_MANAGER
      ServiceRole: !GetAtt BuildAndTestProjectRole.Arn
      Artifacts:
        Type: NO_ARTIFACTS
      Source:
        Type: GITHUB
        Location: https://github.com/superwerker/superwerker.git
        BuildSpec: tests/buildspec-cleanup.yaml

  BuildAndTestProjectRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Principal:
            Service:
              - codebuild.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess # FIXME: least privilege

  CleanupStateMachineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                Fn::Join:
                  - ""
                  - - states.
                    - Ref: AWS::Region
                    - .amazonaws.com
        Version: "2012-10-17"

  CleanupStateMachineRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - codebuild:StartBuild
              - codebuild:StopBuild
              - codebuild:BatchGetBuilds
              - codebuild:BatchGetReports
            Effect: Allow
            Resource:
              Fn::GetAtt:
                - CleanupProjectForStepFunction
                - Arn
          - Action:
              - events:PutTargets
              - events:PutRule
              - events:DescribeRule
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - 'arn:'
                  - Ref: AWS::Partition
                  - ':events:'
                  - Ref: AWS::Region
                  - ':'
                  - Ref: AWS::AccountId
                  - :rule/StepFunctionsGetEventForCodeBuildStartBuildRule
        Version: "2012-10-17"
      PolicyName: CleanupStateMachineRoleDefaultPolicy
      Roles:
        - Ref: CleanupStateMachineRole

  CleanupStateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn:
        Fn::GetAtt:
          - CleanupStateMachineRole
          - Arn
      DefinitionString:
        Fn::Join:
          - ""
          - - '{"StartAt":"QueueCleanupViaCodeBuildStep","States":{"QueueCleanupViaCodeBuildStep":{"End":true,"Retry":[{"ErrorEquals":["States.ALL"],"IntervalSeconds":43200,"MaxAttempts":99999999,"BackoffRate":1.1}],"Type":"Task","Resource":"arn:'
            - Ref: AWS::Partition
            - :states:::codebuild:startBuild.sync","Parameters":{"ProjectName":"
            - Ref: CleanupProjectForStepFunction
            - '","EnvironmentVariablesOverride":[{"Name":"AWS_CROSS_ACCOUNT_ROLE_ARN","Type":"PLAINTEXT","Value.$":"$.AWS_CROSS_ACCOUNT_ROLE_ARN"},{"Name":"SUPERWERKER_REGION","Type":"PLAINTEXT","Value.$":"$.SUPERWERKER_REGION"},{"Name":"AWS_ACCOUNT_ID","Type":"PLAINTEXT","Value.$":"$.AWS_ACCOUNT_ID"}]}}}}'
    DependsOn:
      - CleanupStateMachineRoleDefaultPolicy

Outputs:
  CleanupStateMachine:
    Value: !Ref CleanupStateMachine
    Export:
      Name: superwerker-tests-CleanupStateMachine